CS-413 [BUG] SoA shows "unavailable" to auditor account

[github-actions]

This is an automated pull request to merge chas/soa-as-auditor into dev.
It was created by the [Auto Pull Request] action.

---

Summary by cubic

Add read-only get-setup API (audit:read), pass trusted org ID to the service, and show an empty state when setup is missing so auditors can view SOA without creating records (CS-413).

^{Written for commit eace526. Summary will update on new commits. Review in cubic}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
app	Ready	Preview, Comment	May 25, 2026 8:32pm
comp-framework-editor	Ready	Preview, Comment	May 25, 2026 8:32pm

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
portal	Skipped		May 25, 2026 8:32pm

[linear]

CS-413

[cubic-dev-ai]

1 issue found across 1 file

Confidence score: 2/5

• There is a concrete security/authorization risk: ensure-setup in apps/api/src/soa/soa.controller.ts can create SOA records while only requiring audit:read, which permits mutation under a read-level scope.
• Given the high severity (7/10) and high confidence (9/10), this is likely user-impacting and raises regression risk if merged without tightening permissions for the endpoint.
• Pay close attention to apps/api/src/soa/soa.controller.ts - align endpoint authorization with write/create behavior to avoid privilege escalation.

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[chasprowebdev]

@cubic-dev-ai please review it

[cubic-dev-ai]

@cubic-dev-ai please review it

@chasprowebdev I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

2 issues found across 8 files

Confidence score: 2/5

• There is a high-risk tenant isolation issue in apps/api/src/soa/soa.controller.ts: trusting organizationId from the request body instead of enforcing @OrganizationId() can allow cross-tenant access/update behavior.
• apps/app/src/app/(app)/[orgId]/documents/statement-of-applicability/components/SOAFrameworkTabs.tsx also has a user-facing regression risk where getSOASetup can leave tabs stuck in a perpetual loading spinner when setup is missing or fetch fails.
• Given the high severity (8/10) and high confidence (9/10) on the API scoping issue, this is not quite safe to merge without fixes.
• Pay close attention to apps/api/src/soa/soa.controller.ts, apps/app/src/app/(app)/[orgId]/documents/statement-of-applicability/components/SOAFrameworkTabs.tsx - enforce tenant scoping in the controller and ensure loading/error fallback exits spinner state.

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>